CVE-2026-49145 App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc
Attackers can read arbitrary files by placing a malicious .ackrc in a repository, causing the ack tool to process unauthorized file paths.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49145?
CVE-2026-49145 is a high-severity path traversal vulnerability in PETDANCE App::Ack, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc.
ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted.
A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.
Which versions are affected by CVE-2026-49145?
How do I fix CVE-2026-49145?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-49145 being exploited?
There is no known exploitation of CVE-2026-49145 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-49145, DEBIAN-CVE-2026-49145, GHSA-c2rv-g977-2fxr, UBUNTU-CVE-2026-49145.